Summary: | <dev-db/mysql-5.6.34: multiple vulnerabilities (CPUOCT2016) (CVE-2016-{3492,3495,5507,5584,5609,5612,5616,5624,5625,5626,5627,5628,5629,5630,5631,5632,5633,5634,5635,8283,8284,8286,8287,8288,8289,8290}) | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | normal | CC: | mysql-bugs |
Priority: | Normal | Flags: | kensington:
sanity-check+
|
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
URL: | http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html | ||
Whiteboard: | A2 [glsa cve] | ||
Package list: |
=dev-db/mysql-5.6.34 alpha amd64 arm hppa ia64 ppc ppc64 sparc x86
|
Runtime testing required: | --- |
Bug Depends on: | |||
Bug Blocks: | 599332 |
Description
Agostino Sarubbo
2016-10-19 13:34:42 UTC
Arches, please test and mark stable. The test suite should pass following the official instructions. Local timeouts may be expected on resource starved machines. (each test thread can spawn up to 4 server instances) Target keywords: =dev-db/mysql-5.6.34 alpha amd64 arm hppa ia64 ppc ppc64 sparc x86 # Official test instructions: # USE='embedded extraengine perl ssl static-libs community' \ # FEATURES='test userpriv -usersandbox' \ # ebuild mysql-5.6.34.ebuild \ # digest clean package # Parallel testing is enabled, auto will try to detect number of cores # You may set this by hand. # The default maximum is 8 unless MTR_MAX_PARALLEL is increased export MTR_PARALLEL="${MTR_PARALLEL:-auto}" Stable on alpha. amd64 stable x86 stable Stable for PPC64. arm stable Stable for HPPA. CVE-2016-8290 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-8290): Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Performance Schema, a different vulnerability than CVE-2016-5633. CVE-2016-8289 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-8289): Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows local users to affect integrity and availability via vectors related to Server: InnoDB. CVE-2016-8288 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-8288): Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and 5.7.12 and earlier allows remote authenticated users to affect integrity via vectors related to Server: InnoDB Plugin. CVE-2016-8287 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-8287): Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Replication. CVE-2016-8286 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-8286): Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows remote authenticated users to affect confidentiality via vectors related to Server: Security: Privileges. CVE-2016-8284 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-8284): Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier and 5.7.13 and earlier allows local users to affect availability via vectors related to Server: Replication. CVE-2016-8283 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-8283): Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availability via vectors related to Server: Types. CVE-2016-5635 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5635): Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Security: Audit. CVE-2016-5634 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5634): Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to RBR. CVE-2016-5633 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5633): Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Performance Schema, a different vulnerability than CVE-2016-8290. CVE-2016-5632 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5632): Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows remote administrators to affect availability via vectors related to Server: Optimizer. CVE-2016-5631 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5631): Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: Memcached. CVE-2016-5630 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5630): Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier and 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: InnoDB. CVE-2016-5629 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5629): Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote administrators to affect availability via vectors related to Server: Federated. CVE-2016-5628 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5628): Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: DML. CVE-2016-5627 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5627): Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier and 5.7.13 and earlier allows remote authenticated users to affect availability via vectors related to Server: InnoDB. CVE-2016-5626 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5626): Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availability via vectors related to GIS. CVE-2016-5625 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5625): Unspecified vulnerability in Oracle MySQL 5.7.14 and earlier allows local users to affect confidentiality, integrity, and availability via vectors related to Server: Packaging. CVE-2016-5624 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5624): Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier allows remote authenticated users to affect availability via vectors related to DML. CVE-2016-5616 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5616): Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows local users to affect confidentiality, integrity, and availability via vectors related to Server: MyISAM. CVE-2016-5612 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5612): Unspecified vulnerability in Oracle MySQL 5.5.50 and earlier, 5.6.31 and earlier, and 5.7.13 and earlier allows remote authenticated users to affect availability via vectors related to DML. CVE-2016-5609 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5609): Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier and 5.7.13 and earlier allows remote authenticated users to affect availability via vectors related to DML. CVE-2016-5584 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5584): Unspecified vulnerability in Oracle MySQL 5.5.52 and earlier, 5.6.33 and earlier, and 5.7.15 and earlier allows remote administrators to affect confidentiality via vectors related to Server: Security: Encryption. CVE-2016-5507 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5507): Unspecified vulnerability in Oracle MySQL 5.6.32 and earlier and 5.7.14 and earlier allows remote administrators to affect availability via vectors related to Server: InnoDB. CVE-2016-3495 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3495): Unspecified vulnerability in Oracle MySQL 5.7.13 and earlier allows remote administrators to affect availability via vectors related to Server: InnoDB. CVE-2016-3492 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-3492): Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availability via vectors related to Server: Optimizer. sparc stable ia64 stable ppc stable. Maintainer(s), please cleanup. Security, please add it to the existing request, or file a new one. Cleanup complete This issue was resolved and addressed in GLSA 201701-01 at https://security.gentoo.org/glsa/201701-01 by GLSA coordinator Thomas Deutschmann (whissi). |